Bounty Hunter

---

name: bounty-hunter

description: Automated smart contract bug bounty hunting. Scans Immunefi/Code4rena targets with Slither static analysis, triages findings with local LLMs, and generates PoC templates. Zero API cost for scanning phase.

version: 1.0.0

---

# Bounty Hunter

Automated smart contract vulnerability scanner for bug bounty programs. Uses free tools (Slither + local LLMs) for the heavy lifting, saves expensive models for PoC writing.

Requirements

Quick Start

# Scan a repo
bash scripts/scan.sh <github-repo-url> [src-dir]

# Triage findings (uses local LLM if available, otherwise prints raw)
bash scripts/triage.sh <scan-output.json>

# Generate PoC template for a finding
bash scripts/poc-template.sh <finding-id> <contract-address>

Workflow

1. **Target Selection** — Check Immunefi/Code4rena for active programs

2. **Clone & Scan** — `scan.sh` clones the repo, installs solc, runs Slither

3. **Triage** — `triage.sh` filters HIGH/MEDIUM findings, removes known false positives

4. **Deep Dive** — Only read code that Slither flagged (save your tokens)

5. **PoC** — Use `poc-template.sh` to generate Foundry test scaffolding

6. **Submit** — Write up finding on Immunefi/Code4rena

Target Selection Criteria

Before scanning, check:

Anti-Patterns